In May 2026, the cyber security agencies of five countries published joint guidance on agentic AI: the Australian Signals Directorate’s Cyber Security Centre, the US Cybersecurity and Infrastructure Security Agency, the National Security Agency, and the cyber centres of Canada, New Zealand, and the UK. When every Five Eyes intelligence ally agrees on how to adopt a technology, it’s worth twenty minutes of your time. The document runs long and government-shaped, so here’s what it actually says for a business deciding whether and how to use AI agents.
Who it’s for, in their words
The guidance is aimed at organizations that design, develop, deploy, and operate agentic AI systems. If you’re buying or deploying agents built by someone else, the “deploy and operate” sections are yours, and that’s what this summary covers.
The headline recommendations
Start with low-risk, non-sensitive tasks. The agencies say this twice, which in government writing means “we mean it.” Agents belong first on repetitive, well-defined work that touches nothing sensitive. Save the high-stakes automation for after you’ve operated the boring version safely.
Consider not automating at all. The guidance’s most underrated line: organizations should weigh a full spectrum of solutions for repetitive tasks, including reducing or eliminating the low-value process entirely. An agent on top of a broken process is a faster way to do the wrong thing. If a workflow is low-value enough to question, question it before you automate it.
Never grant broad or unrestricted access. Agents should hold the least privilege their task allows, with access aligned to your existing security model. This matches what the same agencies say about AI generally: align agent risk with the security program you already run, not a parallel AI-specific one.
Treat the agent lifecycle as security work. The document organizes best practices across design, development, deployment, and operation. For a buyer, the deployment and operation parts matter most: progressive rollout starting with the least autonomy, monitoring against expected behavior, and a way to revert to known-good behavior when something drifts.
Plan for things to go wrong. The agencies recommend fail-safe defaults and containment mechanisms that limit the blast radius of unexpected behavior, plus data loss prevention tuned to AI agent behaviors. Translation: assume the agent will sometimes do the wrong thing, and design so the wrong thing is small and reversible.
Why agents got their own guidance
You may already use generative AI for drafting and search. Agents are a different risk class: they reason, plan, and act with your credentials. Each component they carry, tools, data sources, memory, widens the attack surface, and the agencies specifically call out that agents inherit every vulnerability of the underlying model plus new ones from every connection you add.
The five-line takeaway
- Inventory what your agents can reach before you add another one.
- Least privilege per agent, enforced in infrastructure, not in prompts.
- Start on tasks where a mistake costs an hour, not a customer.
- Monitor behavior against a baseline and be able to roll back.
- Fix the process before automating it.
That’s the guidance, minus the committee prose. If you’re evaluating AI workflow automation and want it done under these rules from day one, that’s the standard we build to.